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A SHORTENED STATUTORY PERIOD FOR REPLY IS SET TO EXPIRE 3 MONTH(S) FROM 
THE MAILING DATE OF THIS COMMUNICATION. 

- Extensions of time may be available under the provisions of 37 CFR 1 .136(a). In no event, however, may a reply be timely filed 
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2a)D This action is FINAL. 2b)S This action is non-final. 

3) D Since this application is in condition for allowance except for formal matters, prosecution as to the merits is 

closed in accordance with the practice under Ex parte Quayle, 1935 CD. 11, 453 O.G. 213. 
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4) H Claim(s) 1-10 is/are pending in the application. 

4a) Of the above claim(s) is/are withdrawn from consideration. 

5) D Claim(s) is/are allowed. 

6) K Claim(s) 1-10 is/are rejected. 

7) D Claim(s) is/are objected to. 
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Application Papers 

9) D The specification is objected to by the Examiner. 

10) 13 The drawing(s) filed on 06 December 1999 is/are: a)M accepted or b)D objected to by the Examiner. 
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DETAILED ACTION 



Response to Amendment 

1 . Examiner withdraws the 35 U.S.C. 112, first paragraph rejection as the 
amendment to the claims overcome the rejections. 

Response to Arguments 

2. Based on careful consideration of Applicant's remarks on pages 6-7 in the 
amendment filed on August 12, 2004, Applicant's arguments that Frisch does not teach 
a variable security profile specifying a variable number of unsuccessful power-on 
attempts have been fully considered and are persuasive. Hence, the 102(a) rejections 
of claims 1-9 have been withdrawn. However, upon further consideration, a new 
ground(s) of rejection is made in view of Golding et al. U.S. Patent No. 5,265,163 and 
Frisch. 



Claim Rejections - 35 USC § 103 

3. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 

obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 102 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 
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4. Claims 1-9 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Golding et al. U.S. Patent No. 5,265,163 (hereinafter Golding) in view of Frisch 
Essential System Administration 2 nd Edition (hereinafter Frisch). 

5. As per claim 1 , Golding teaches a computer system having a power-on password 
stored in non-volatile memory wherein entry of a power-on password enables entry to 
the computer system. See Golding, col. 2, lines 18-65. Golding does not teach a 
variable security profile wherein the variable security profile is automatically generated 
when the system is turned on, the variable security profile specifying: a variable number 
of unsuccessful power-on password attempts permitted based upon at least one other 
factor chosen from time of day and day of week; and a security level of authorization of 
the user; and allowing or denying use of the personal computer to the user based on the 
security profile. Frisch teaches a variable security profile specifying a variable number 
of unsuccessful password attempts permitted based upon a security level of 
authorization of the user; and allowing or denying use of the personal computer to the 
user based on the security profile. See Frisch, pages 160-163, 'C2 security-style 
password restrictions', especially page 160, 2 nd full paragraph and page 161, Table 5-2, 
'u_maxtries\ It would be obvious to one of ordinary skill in the art at the time the 
invention was made to combine the variable security profile as taught by Frisch with the 
power-on password check disclosed by Golding to enable a higher level of security as 
required by establishments using the system. See Frisch, page 160, 1 st full paragraph. 
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6. Further, Frisch does not expressly disclose the variable security profile is 
generated automatically when the system is turned on. However, Frisch teaches 
automatically running files under the /tcb directory (the security-related directory which 
holds the protected password database disclosed by Frisch in page 160) and preparing 
the system automatically when the system is turned on with available security 
measures. See Frisch, page 111, Figure 4-1 and page 101, 'Security-related activities'. 
It would be obvious to one of ordinary skill in the art at the time the invention was made 
to generate the variable security profile when the system is turned on. Motivation to 
combine ensures security features of a system are active during the entire course of 
operation of the computer system. Ibid. 

7. Finally, Frisch does not expressly disclose the variable number of unsuccessful 
power-on password attempts permitted to be based also upon at least one other factor 
chosen from the time of day and day of week in the aforementioned sections. Frisch 
teaches, in a different section, restricting login access based on the time of day of the 
login request. See Frisch, page 224-225, 'Limiting user access to certain days and/or 
times of day'. It would be obvious to one of ordinary skill in the art at the time the 
invention was made for the number of unsuccessful power-on password attempts 
permitted to be based also upon at least one other factor chosen from time of day and 
day of week to prevent access to only those times when the user is scheduled to login, 
which ensures a more secure login system as known to one of ordinary skill in the art 
and as taught by Frisch. Ibid. The aforementioned cover the limitations of claim 1 . 
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8. As per claim 2, Golding covers a system as outlined above in the claim 1 
rejection under 35 U.S.C. 103(a). In addition, Frisch discloses including a log of the 
access attempts for the personal computer and the results of each attempt. See Frisch, 
pages 262-263, 'Monitoring unsuccessful login attempts'. The aforementioned cover 
the limitations of claim 2. 

9. As per claim 3, Golding covers a system as outlined above in the claim 2 
rejection under 35 U.S.C. 103(a). In addition, Frisch discloses only the superuser (root) 
is able to update the /etc/password and /etc/shadow files, which work in concert with the 
protected password database. See Frisch, page 144, second paragraph; pages 153- 
154, 'Shadow password files'; page 154-155, 'password file permission'. It follows that 
only the root (a system administrator) is able to update the protected password 
database to a less secure state. Motivation to update the variable security profile to a 
less secure state only by the system owner ensures only the requisite authority is able 
to change the state of the system to a less secure state as taught by Frisch. Ibid. The 
aforementioned cover the limitations of claim 3. 

10. As per claim 4, Golding covers a system as outlined above in the claim 3 
rejection under 35 U.S.C. 103(a). Golding does not disclose enabling a normal user to 
alter the variable security profile to a more secure state. Frisch discloses additional 
security profiles to establish a level of security in the personal computer, which include 
establishing and updating permissions on files owned by a user, wherein a user is 
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capable of changing the access level of their own files. See Frisch, pages 234-238, 
'AIX access control lists' and pages 25-32, 'File Ownership 1 and Tile Protection 7 . It 
would be obvious to one of ordinary skill in the art at the time the invention was made 
for a normal user to alter the variable security profile to a more secure state. Motivation 
to combine enables normal owners of files to increase restrictions on personal data as . 
taught by Frisch. Ibid. The aforementioned cover the limitations of claim 4. 

11. As per claims 5 and 6, Golding covers a system as outlined above in the claim 4 
rejection above under 35 U.S.C. 103(a). Although Golding does not teach using binary 
indicators to set the secure state level, binary fields are the standard in the industry for 
storing any digital information. As argued above, normal users can change file 
permissions they own to more secure states and the root user can alter the state of a 
system to less secure states by making file and login access less restrictive. Both of 
these changes are reflected in memory as binary manipulations. Hence, the 
aforementioned cover the limitations of claims 5 and 6. 

12. As per claims 7-9, Frisch covers a method of providing improved security in a 
personal computer having an operating system and a security profile as outlined above. 
Further, as mentioned above, each user can modify the access level on files they own, 
wherein the root user is able to modify all files, including the protected password 
database, /etc/password and /etc/shadow files. Moreover, the administrator updates 
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the variable security profile in response to a security risk. See Frisch, page 223, last 
paragraph. The aforementioned cover the limitations of claims 7-9. 

13. Claim 10 is rejected under 35 U.S.C. 103(a) as being unpatentable over Golding 
in view of Frisch as applied to claims 7-9 above, and further in view of Schmidt U.S. 
Patent No. 5,912,621 (hereinafter Schmidt). 

14. As per claim 10, Golding covers a security methodology implemented in a 
personal computer as defined above in the claim 7-9 rejections under 35 U.S.C. 103(a). 
Golding does not teach that a response by the operating system is made when the 
cover of the computer is removed. Schmidt teaches a computer system responsive to 
the removal of its physical encasing; specifically, a state reporting program is run to poll 
the status of an auxiliary state element, which detects when the cover is removed. A 
state report is further submitted to security personal for examination and further action. 
See Schmidt, col. 1, line 51 -col. 2, line 7. It would be obvious to one of ordinary skill in 
the art at the time the invention was made to combine the computer cabinet security 
state detection system with a computer system restricting power-on login access using 
the variable security profile. Motivation to combine includes addressing physical threats 
to prevent tampering of the physical devices of a computer and thereby enabling a more 
robust computer security system. See Schmidt, col. 1, lines 1-10 and 35-50. The 
aforementioned cover the limitations of claim 10. 
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Conclusion 

The prior art made of record and not relied upon is considered pertinent to 
applicant's disclosure. 

Parzyeh et al. U.S. Patent No. 5,375,243. 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Jung W Kim whose telephone number is (571 ) 272- 
3804. The examiner can normally be reached on M-F 9:00-5:00. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Gilberto Barron can be reached on (571) 272-3799. The fax phone number 
for the organization where this application or proceeding is assigned is 703-872-9306. 

Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). 

Jung W Kim 
Examiner 
Art Unit 2132 

Jk 

THOMAS R.PEESO 
PRIMARY EXAMINER 





